Privacy policy

1. Controller

Mind63 GmbH, Römerstr. 76/1, 74078 Heilbronn, Germany.Represented by the managing director Eugen Falkenstein.Privacy questions: privacy@ludowish.com.

We have not appointed a data protection officer; the conditions of § 38 BDSG do not apply. Send your requests to the address above.

2. What we store

We keep data to a minimum. We store:

• Account: e-mail (encrypted, plus a hash for sign-in), password hash, date of birth (encrypted), country, language, time zone.
• Profile: username, display name, avatar, optional bio, optionally the day and month of your birthday.
• Content: lists, wishes, uploaded images, reactions.
• Connections: who you follow, who follows you, blocks, reports.
• Technical: last sign-in, devices for push, error logs without personal reference.

We store no addresses, phone numbers, location data or advertising identifiers, and we never import contacts.

3. Child profiles and teen accounts

Children under 13 use Ludowish through a profile inside a parent's account. The parent gives consent and can pause or delete the profile and export its data at any time. Child profiles are never public, never discoverable and have no e-mail address.

Teenagers between 13 and their country's age threshold need a parent's approval. We create an approval link that the teenager forwards themselves. We do not store a parent's e-mail address for this.

4. Guests

Anyone reserving without an account receives an anonymous guest token. An e-mail address is optional and is used only to manage the reservation and to send reminders. Reservation data is anonymised 90 days after the occasion.

5. Wish links and images

When you paste a shop link, our server fetches the page and stores title, price and one image. The fetch happens from our server, not from your device. We host images ourselves so your browser never talks to the shop.

6. Recipients and processors

We do not pass your data to anyone in order to make money from it. There are no ad networks, no third-party tracking and no sale of data.

To run the service we use providers who process data on our behalf and on our instructions. There is a processing agreement under Art. 28 GDPR with each of them.

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany - the servers and databases Ludowish runs on. Privacy policy: hetzner.com
• Scaleway SAS, 8 rue de la Ville l'Évêque, 75008 Paris, France - object storage for images (Paris data centre) and delivery of our e-mails. Privacy policy: scaleway.com
• BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia - delivery of images and static files over a content delivery network, and DNS. Your IP address is processed in the course of this. Privacy policy: bunny.net

All three process within the EU or the EEA. No transfer to a third country takes place.

Push notifications on mobile devices cannot bypass the operating system:

• Apple Inc. (Apple Push Notification service) and Google Ireland Ltd. (Firebase Cloud Messaging) deliver the notifications.
• Expo (650 Industries, Inc.), 1 Letterman Drive, San Francisco, CA 94129, USA, relays them to both services. Privacy policy: expo.dev

What travels is a device token and the text of the message, no e-mail address and no date of birth. Where data reaches the USA, we rely on standard contractual clauses under Art. 46 (2) (c) GDPR. Push is voluntary: without your consent on the device we register no token.

Error and access logs are evaluated on our own servers. Authorities receive data only where we are legally obliged to provide it.

7. Retention

Deleted accounts are removed completely after a 14-day grace period. Consent evidence is kept for three years. Accounts that are never confirmed are deleted after seven days.

8. Legal bases

We process your data on these grounds:

• Contract (Art. 6 (1) (b) GDPR) for everything Ludowish is: account, lists, wishes, sharing, reservations, service notifications.
• Consent (Art. 6 (1) (a) GDPR) for push notifications, for the e-mail address guests give voluntarily when reserving, and for anything we ask you about explicitly. For child profiles the parent gives it (Art. 8 GDPR).
• Legitimate interest (Art. 6 (1) (f) GDPR) for security and abuse prevention: rate limits, blocklists, moderation of reported content, error logs. Our interest is a service that is safe for children too.
• Legal obligation (Art. 6 (1) (c) GDPR) for consent records and for information we are required to provide.

9. Your rights

You have the following rights against us. They are free, and you do not have to give a reason.

• Access (Art. 15 GDPR) - which data we hold about you, where it came from, who we pass it to and how long we keep it. You get a complete copy without asking anyone: in your settings under "Data export", as a ZIP file.
• Rectification (Art. 16 GDPR) - correct anything wrong. Profile, display name, e-mail and language you change in your settings directly.
• Erasure (Art. 17 GDPR) - the "right to be forgotten". You delete your account in your settings. A 14-day grace period follows in which signing in cancels the deletion; after that we remove account, profile, lists, wishes and images.
• Restriction of processing (Art. 18 GDPR) - instead of deleting, we can block data, for instance while its accuracy is disputed.
• Data portability (Art. 20 GDPR) - your data in a common, machine-readable format. The data export delivers JSON and the images you uploaded.
• Objection (Art. 21 GDPR) - against processing we base on a legitimate interest. After your objection we continue only if we can demonstrate compelling legitimate grounds.
• Withdrawal of consent (Art. 7 (3) GDPR) - at any time, with effect for the future. Push you switch off in your settings; consent for a child profile is withdrawn by the parent in the guardian area. The lawfulness of processing up to the withdrawal is unaffected.
• Complaint to a supervisory authority (Art. 77 GDPR) - with any data protection authority, in particular the one where you live or the one responsible for us.

How to exercise them

Write to privacy@ludowish.com or to the address in section 1. We answer within one month. If a request is particularly extensive we may extend by two months and will tell you so within the first month.

We ask only for as much as identification requires. For a child profile the rights are exercised by the parent who gave the consent.

Competent supervisory authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-WürttembergLautenschlagerstraße 20, 70173 Stuttgart, Germanybaden-wuerttemberg.datenschutz.de

Automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. Our spam detection flags accounts for review; a human decides what happens.

10. Analytics

We use cookie-free, self-hosted analytics without personal reference. There is no cookie banner because we set no cookies for analytics or advertising.